WordPress 6.9 introduced the Abilities API as a consistent way to register what a site can do. Each Ability has a name, description, input and output schemas, a permission rule, and a callback that performs the work. Plugins no longer need to invent a different automation contract for every action.
Why it matters
A plugin might register “list low-stock products” or “create a draft.” Other tools can discover the contract and validate data before execution. This helps integrations, admin interfaces, and AI tools because the capability is separate from the interface that calls it.
A structured name does not make an operation secure. Write a real permission_callback, narrow every input, and do not expose a sensitive action simply because it can be automated. Changes to data or public content also need an audit trail.
Try it quickly
Start with one read-only Ability. Define its input and output schemas, then test it under users with different roles. If the result exposes more data than the caller needs, fix the contract before registering any write action.
Source: the official Abilities API handbook.